EMZETT.
Login

Emzett Wiki

Windows Event Viewer: troubleshooting in the logs

Properties1
tagsglossar, windows, fehlersuche

2 min read

Windows Event Viewer: troubleshooting in the logs

In short: The Event Viewer collects messages from Windows and programs; with filters by time, source and event ID you find causes of crashes, blue screens and boot problems.

In more detail: When a PC crashes, do not guess, look in the logs. Windows writes messages into event logs; the Event Viewer (eventvwr.msc) displays them.

In Depth

Important logs

  • Windows Logs → System: drivers, services, hardware, restarts, disk errors.
  • Application: program crashes (“Application Error”, event ID 1000).
  • Security: logons (4624 successful, 4625 failed) – only with auditing enabled.
  • Setup: updates and installations.
  • Applications and Services Logs: detailed logs, e.g. PowerShell, Defender, Task Scheduler.

Important events

  • Kernel-Power 41: PC was shut down uncleanly/crash/power supply.
  • BugCheck 1001: blue screen with stop code.
  • Disk 7/11/51/153, NTFS 55: disk/cable problems.
  • WHEA-Logger 17/18/19: hardware errors (CPU, RAM, PCIe).
  • Service Control Manager 7000/7031/7034: service does not start/crashes.
  • Event 6005/6006: event log started/stopped (≈ boot/shutdown).
  • Windows Update 20/25: update error with code.

Filtering and searching

On the right Filter Current Log: time range (last hour), level (critical, error, warning), event ID, source. The pane below shows the text; the “Details” tab the XML data. Tip: first note the time of the problem, then look near it for errors just before. Entering an event ID plus source into a search engine usually yields guides. Custom views and saving as .evtx for sharing.

PowerShell and reliability

Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-1)} | Select -First 20 TimeCreated,Id,ProviderName,Message
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000}

Reliability Monitor (perfmon /rel) shows crashes as a timeline. For blue screens: read minidumps (C:\Windows\Minidump) with WinDbg or BlueScreenView. If hardware is suspected: chkdsk, sfc /scannow, DISM /Online /Cleanup-Image /RestoreHealth, Windows Memory Diagnostic, temperatures. On servers: forwarding to central SIEM/log systems.

See also: dmesg and journalctl, Windows Task Scheduler

Backlinks